Subject: RE: namedroppers, continued

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 2 Dec 2002 11:12:36 -0800

First off, the problem of SPAM is one of the perfect being the enemy of
the good. If we can cut the spam by 95% then that is a pretty useful
achievement.

So, no I don't think that the folk selling feather luggage, herbal
viagra, p0rn etc are likely to go to that length in great numbers,
unless that is the Internet as a whole adopts the same type of measure
following our lead.

However I have thought ahead to the issues of scale here, let us imagine
that a large number of groups use the same scheme, that email agents
that filter based on signatures are available and widely used.

First, consider the effect of a minor authentication requirement on
certificate issue, the ability to read email sent to the address
specified in the certificate. Using that technique we could eliminate
spams with bogus addresses which itself would be a major advance. The
amount of spam that comes through with a valid email address is
vanishingly small.

Second consider that if the whole internet follows our lead and starts
to use cryptography routinely there are a lot of additional steps that
then become possible that are not practical until most people have a
public key and there is a means of discovering that via a DNS linkage.

Third one of the things we could do in an extended enrollment process
would be to get participants to agree to the following set of terms:

	1) Thou shalt not SPAM.
	2) Thou shalt permit your messages to be posted in the archives.
	3) Thou shalt provide timely notice of any intellectual property
claims.
	4) Thou shalt not take the name of the chair in vain unless she
deserves it.
	5) etc.

Then we could sue the b*#*@#&ds if they spammed after that. People have
been looking for a test case for digital signatures for ages, so don't
worry about the cost.

A side benefit of this is that it would cause a lot of people to start
using secure email and thus start to create some critical mass for email
security.

What we need is for someone to take Majordomo or the like and merge in
some sort of filter to check S/MIME and PGP signatures. Then find a
group that wanted to serve as a guinea pig (S/MIME or PKIX perhaps?).

Alternatively we should perhaps form a group 'Deployment of secure
email' which could apply this rubric.

		Phill

> -----Original Message-----
> From: Aaron Swartz [mailto:[email-masked]]
> Sent: Monday, December 02, 2002 1:43 PM
> To: Hallam-Baker, Phillip
> Cc: [email-masked]; [email-masked]; [email-masked]
> Subject: Re: namedroppers, continued
>
>
> Hallam-Baker, Phillip wrote:
> > The only way to resolve this issue properly would be to
> require every
> > submission to an IETF mailing list to be cryptographically signed
> > [and] to require the subscribers to register their signing key
>
> And how do we prevent spammers from registering their signing
> key? Are
> you suggesting that we change the IETF's open enrollment policy?
>
> --
> Aaron Swartz [http://www.aaronsw.com]
>

---

From: [email-masked]
Date: Mon, 02 Dec 2002 16:54:20 -0500

> amount of spam that comes through with a valid email address is

You don't need a cert for this - a simple "OK this magic cookie" confirmation
scheme (as supported by almost all mailing-list management software) is enough.

> been looking for a test case for digital signatures for ages, so don't

People have been looking for somebody ELSE to be the test case for ages.
The EFF is in the business of raising money to fight legal battles. The
IETF isn't.  You might want to ask the IESG if they have the budget for
this - and remember that quite often, there *isnt* case law about some
interesting point because one party or the other decides it's easier and
cheaper to just settle rather than take it to court.
-- 
				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech